A ThreadX module chooses "object_size" when it calls "txm_module_object_allocate". The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result without checking the addition. A size near the top of a "ULONG" wrapped, the pool served a block far smaller than the header, and the manager then wrote the header past the end of it and into the neighbouring byte-pool block.